CVE-2023-24623
Paranoidhttp Server-Side Request Forgery vulnerability
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
CVE-2023-24623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
CVE-2023-24623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2023-0556
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
EUVD-2023-0556- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v9mp-j8g7-2q6m
Paranoidhttp Server-Side Request Forgery vulnerability
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
GHSA-v9mp-j8g7-2q6m- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
CVE-2023-24623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-v9mp-j8g7-2q6m
Paranoidhttp Server-Side Request Forgery vulnerability
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
GHSA-v9mp-j8g7-2q6m- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGO-2023-1526 No score
Server-side request forgery in github.com/hakobe/paranoidhttp
Paranoidhttp before is vulnerable to SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
- Record
GO-2023-1526- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hakobe/paranoidhttpGo |
before 0.3.0 | 0.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-24623 is a high vulnerability (CVSS 7.5) in Paranoidhttp Project Paranoidhttp, published January 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 54th percentile. Fixed in github.com/hakobe/paranoidhttp 0.3.0.
References
github.com/hakobe/paranoidhttp/blob/master/CHANGELOG.md
nvd.nist.gov/vuln/detail/CVE-2023-24623
pkg.go.dev/vuln/GO-2023-1526